Do not resize images greater than 32767 pixels in either dimension

Internally, the resizing code uses the rockbox dim structure, which uses signed shorts.

Change-Id: Ic8850e8563a9d8c0cb3cf8269e2576be9e42b45b

1 files changed, 9 insertions, 0 deletions

diff --git a/apps/recorder/jpeg_load.c b/apps/recorder/jpeg_load.c
index 16a2f4e3a3..9ab42b7a9f 100644..100755
--- a/apps/recorder/jpeg_load.c
+++ b/apps/recorder/jpeg_load.c
@@ -2050,6 +2050,15 @@ int clip_jpeg_fd(int fd,
     if (!(status & DHT)) /* if no Huffman table present: */
         default_huff_tbl(p_jpeg); /* use default */
     fix_headers(p_jpeg); /* derive Huffman and other lookup-tables */
+
+    /*the dim array in rockbox is limited to 2^15-1 pixels, so we cannot resize
+      images larger than this without overflowing */
+    if(p_jpeg->x_size > 32767 || p_jpeg->y_size > 32767)
+    {
+        JDEBUGF("Aborting resize of image > 32767 pixels\n");
+        return -1;
+    }
+
     src_dim.width = p_jpeg->x_size;
     src_dim.height = p_jpeg->y_size;
     if (format & FORMAT_RESIZE)